[fix](function) Reject overflowing IPv6 uint128 strings

be/src/core/value/ipv6_value.h

@@ -17,6 +17,7 @@
 
 #pragma once
 
+#include <limits>
 #include <regex>
 #include <sstream>
 #include <string>
@@ -43,12 +44,24 @@ class IPv6Value {
     bool from_string(const std::string& ipv6_str) { return from_string(_value, ipv6_str); }
 
     static bool from_uint128_string(IPv6& value, const char* ipv6_str, size_t len) {
+        if (len == 0) {
+            return false;
+        }
+
+        constexpr IPv6 max_value = std::numeric_limits<IPv6>::max();
+        constexpr IPv6 max_value_div_10 = max_value / 10;
+        constexpr IPv6 max_value_mod_10 = max_value % 10;
         value = 0;
         for (size_t i = 0; i < len; ++i) {
             if (ipv6_str[i] < '0' || ipv6_str[i] > '9') {
                 return false; // illegal character for uint128
             }
-            value = value * 10 + (ipv6_str[i] - '0');
+            const auto digit = static_cast<IPv6>(ipv6_str[i] - '0');
+            if (value > max_value_div_10 ||
+                (value == max_value_div_10 && digit > max_value_mod_10)) {
+                return false;
+            }
+            value = value * 10 + digit;
         }
         return true;
     }

be/test/exprs/function/function_ip_test.cpp

@@ -80,6 +80,24 @@ TEST(FunctionIpTest, StringToNumRejectsEmbeddedNullTail) {
     check_function_all_arg_comb<DataTypeString, true>("inet6_aton", input_types, ipv6_null_data);
 }
 
+TEST(FunctionIpTest, IPv6FromUInt128StringRejectsEmptyAndOverflow) {
+    const std::string max_uint128 = "340282366920938463463374607431768211455";
+    IPv6 max_value = 0;
+    EXPECT_TRUE(IPv6Value::from_uint128_string(max_value, max_uint128.data(), max_uint128.size()));
+    EXPECT_EQ(max_value, static_cast<IPv6>(-1));
+
+    for (const auto& value :
+         {std::string("340282366920938463463374607431768211456"),
+          std::string("680564733841876926926749214863536422913"), std::string()}) {
+        IPv6 parsed = 0;
+        EXPECT_FALSE(IPv6Value::from_uint128_string(parsed, value.data(), value.size()));
+    }
+
+    IPv6 parsed = 0;
+    EXPECT_TRUE(IPv6Value::from_uint128_string(parsed, "1", 1));
+    EXPECT_EQ(parsed, static_cast<IPv6>(1));
+}
+
 TEST(FunctionIpTest, StringToIPv6AcceptsLongIPv4Spellings) {
     std::string mapped_ipv4_zero(IPV6_BINARY_LENGTH, '\0');
     mapped_ipv4_zero[10] = static_cast<char>(0xff);